ci: use asdf to lock versions of frequently used build tools (go and node)
Created by: ggilmore
In multi-stage Docker files, I attempted to make our builds completely hermetic by locking our build tools’ versions and generating all artifacts inside the docker build process. This turned out to be too slow to merge due to problems with our existing Docker infrastructure.
In the meantime, we can achieve a weaker version of reproducibility by locking some of the build tools that we upgrade the most often: Go and Node.
I propose that we use https://github.com/asdf-vm/asdf to manage the versions of these tools:
- It's a well-supported project
- It has a plugin system that supports multiple languages (Go, Node, etc.) as well as common tools (
hadolint,shellcheck, etc.) - It has a configuration file that can be checked into the repository, and we can simply use
asdf installto get the versions of that tool that are specified in the config file